Yes, I have the same concern.   I haven't started my personal instance for more than a month, I have not set up any auto indexing. Just uploaded some personal financial data as csv.  Now I open to look at the data and now I get message.   " Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK." My company has an enterprise license and I am not planning to purchase a personal license. I would love to use the personal instance to play with limited personal data and learn Splunk features.    But the "Free" license does not look free, just a bait ... ... View more

Not true. Many places say "just download the universal forwarder and the app and install" does not work. Still errors out . 01-27-2015 19:52:39.782 +1000 ERROR TcpOutputFd - Read error. An existing connection was forcibly closed by the remote host. 01-27-2015 19:52:40.942 +1000 INFO TcpOutputProc - Connected to idx=54.84.49.180:9997 using ACK. 01-27-2015 19:52:47.265 +1000 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying... ... View more

FYI - I don't believe it's possible to add a SearchBar using SimpleXML in 6.x. See: http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/PanelreferenceforSimplifiedXML ... View more

I edited the visualization to add this: <option name="charting.chart.sliceCollapsingThreshold">0.01</option> But i did so through the UI by clicking on the "paint brush" above the pie chart when in edit mode and setting the "minimum size" to 0%. Doing that added the above to the dashboards xml. ... View more

Why isn't the app available anymore? is there any other way to integrate facebooka api with splunk? ... View more

I think the only way to do this would be to create your own custom event renderer with CSS: http://www.splunk.com/base/Documentation/latest/Developer/EventRendering ... View more

Why are you trying to do this? I believe that whatever you are trying to accomplish, that this is a very deeply misguided approach. I assume you're trying to create a backup or replica of a Splunk index in as close to real-time as possible, but doing it this way will massively hurt search performance (unless you're managing to index a couple of GB every 5 minutes on a single node). Please look at forwarding, or distributed search, or filesystem snapshots, or rethink whether this copying or replica or whatever is even needed. ... View more

Thanks! I'll try this out. ... View more

If you find yourself setting MAX_EVENTS to be very large, you should probably consider changing the LINE_BREAKER to break the input stream into larger chunks (that aren't single lines). At index time, data is broken into lines (usually by \r\n or \n ). It then may be put back together using line merging. It's significantly more efficient to not have to reassemble the data with string concatenation. You then have to set the maximum "line" length using the TRUNCATE attribute. If you know that every event is demarcated by two newlines, you could set in props.conf: [<sourcetype>] LINE_BREAKER = ((\r?\n){2}) TRUNCATE = 1000000 SHOULD_LINEMERGE = false ... View more

You can either set MAX_EVENTS high, which will take CR-LF delimited lines and merge them up to 256 lines, or you can use the TRUNCATE = 0 LINE_BREAKER = (?!) SHOULD_LINEMERGE = false method, except that the LINE_BREAKER = (?!) will only split an event at the end of input, i.e., it's only going to work when you get a new file, or if it's a scripted input that gets invoked once for each event. SHOULD_LINEMERGE = false potentially has much better performance, but probably if you use it, you should use: LINE_BREAKER = ([\r\n]+)\d{2}-\d{2}-\d{4}\s+\d{1,2}:\d{2}:\d{2} FURTHERMORE, I notice that you don't have a time zone specified in your timestamp, I strongly recommend that you include the time zone in your timestamp (unless you are committed to always logging those in UTC, in which case it wouldn't hurt to include Z at the end anyway). ... View more

You have a summary index search configured on machine1 that puts data into the index summary_forwarders that doesn't exist on machine2 or machine3. This is probably from the beta SplunkDeploymentMonitor app. Is it installed only on machine1? ... View more

It would be helpful if you showed up the original data you are summarizing over. It seems to me that your quotes are wrong in your reporting query, but maybe that's from some copy/paste to here. Also, either (the former is probably preferable): Your summarizing search should use sistats instead of stats ; or Your reporting search should use sum(count) instead of count Nevertheless, you should be getting a correct field extraction. Sometimes, the field extraction rules for summary data have been overridden, possibly because the sourcetype has been changed from stash , or some host-based or source-based rule takes precedence and prevents it from running right. I will also note that your schedule will generate summaries over time ranges from 01:02:00 - 01:06:59 01:07:00 - 01:11:59 01:12:00 - 01:16:59 01:17:00 - 01:21:59 ... etc. which while correct, are not particularly great if you wanted to aggregate or timechart up to 15min or 1h intervals typically on a quarter-hour or hour. Better to line them up on 5 minute markers by changing the cron to 3,8,13,18,23,28,33,38,43,48,53,58 * * * * ... View more

It appears that the raw values of CLUSTER, VMHOST and VM have a leading whitespace character. The solution is to add a trim() index="vmware" sourcetype="esxtop_Group_Cpu" host=* id=* | rex field=_raw "id=[\d]+:(?P .*)" | fields VM pct_CoStop | stats avg(pct_CoStop) by VM | join type=inner VM [search index="vmware" sourcetype="VM_Inventory" | head 1 | multikv fields DATACENTER CLUSTER VMHOST VM | table DATACENTER CLUSTER VMHOST VM | eval VM = trim(VM)] ... View more

I have another thread here about doing join operation http://answers.splunk.com/questions/5756/not-getting-results-from-join ... View more

This would be help!! http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/RemovedatafromSplunk Just ready carefully... and always backup your files!! Regards Cris ... View more

Mike, the current release on Splunkbase now supports multiple profiles/servers on a single physical box. We have also updated the documentation to be a little more helpful for setting up forwarding and receiving in a distributed environment. ... View more

Does this revised app work for you, Maarten? ... View more

There are two ways, but neither of them are particularly fun. 1) harder, but technically allows you to apply CSS to manager pages, including setup.xml :: Create a custom module. Give that custom module a ModuleName.css file, then make a copy of the search app's view called "_admin.xml" and place it in your app. Edit your version of _admin.xml to include your custom module. How your custom module and its CSS file will be loaded in every manager page. This is a tough road. 2) easier, but you have to be a little familiar with jquery:: application.css is not loaded in Manager, but for some reason application.js is, and you can take advantage of that. You can use jquery to apply CSS to the page. The scope of what I mean by that is rather large, but readers who are familiar with jquery you'll know what I mean. Also for #2, I always wrap this stuff in either an if statement or a switch statement to only apply these changes in manager, and only in the setup.xml page. // only do stuff in Manager please. if (Splunk.util.getCurrentView()=="_admin") { // only do stuff in setup.xml pages please... if (document.location.toString().indexOf("/setup")!=-1) { doStuff(); } } ... View more

You can also include JavaScript directory in the setup page directly using a CDATA block inside of a text node. This is useful when you have JavaScript that you want to only execute on the setup page (otherwise, you'll need to check the URL to determine if the current page is the setup page). Consider the following that open the jQueryUI date picker dialog when the input block is clicked: <text> <![CDATA[ <script> $(function() { $( "#datepicker" ).datepicker(); }); </script> <div class="demo"> <p>Date: <input type="text" id="datepicker"></p> </div> ]]> </text> ... View more

Thanks, I'll try this out 🙂 ... View more

Are you sure that your file is gziped? I find the unix file utility very helpful for these types of things. Try file app.spl ... View more